CVE-2026-60156: Oracle APEX Information Disclosure Flaw

CVE-2026-60156 Overview

CVE-2026-60156 is an information disclosure vulnerability in Oracle Application Express (APEX), affecting the General component. The flaw impacts supported versions 24.1, 24.2, and 26.1. An unauthenticated attacker with network access via HTTP can exploit the issue to gain unauthorized read access to a subset of Oracle APEX accessible data. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can read a subset of Oracle APEX data over HTTP without user interaction.

Affected Products

Oracle APEX version 24.1
Oracle APEX version 24.2
Oracle APEX version 26.1

Discovery Timeline

2026-07-21 - CVE-2026-60156 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60156

Vulnerability Analysis

CVE-2026-60156 resides in the General component of Oracle APEX, a low-code web application development platform bundled with Oracle Database. The vulnerability enables an unauthenticated attacker to reach the vulnerable code path over the network using HTTP. Successful exploitation results in unauthorized read access to a subset of data accessible to Oracle APEX.

The issue is scoped to confidentiality. Integrity and availability are not affected, and privilege escalation is not part of the exploitation chain. The attack requires no user interaction and no prior credentials, which lowers the barrier for opportunistic scanning against internet-exposed APEX deployments.

The EPSS score is 0.316% with a percentile of 23.812, indicating a low observed likelihood of active exploitation at publication time. No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is mapped to [CWE-200], which describes exposure of sensitive information to an actor not explicitly authorized to receive it. In Oracle APEX, this class of flaw typically stems from insufficient access controls on a data-returning code path or from improper filtering of records returned to unauthenticated requests. Oracle has not published detailed technical internals beyond the advisory.

Attack Vector

Exploitation occurs over the network via HTTP against an exposed Oracle APEX instance. The attacker sends crafted requests to trigger the information disclosure code path in the General component. Because authentication and user interaction are not required, any HTTP-reachable APEX endpoint running an affected version is in scope. See the Oracle Security Alert - July 2026 for vendor-supplied context.

No verified code examples are available. Refer to the Oracle advisory for technical guidance.

Detection Methods for CVE-2026-60156

Indicators of Compromise

Unauthenticated HTTP requests to Oracle APEX endpoints from unexpected source IPs, particularly against the General component.
Repeated HTTP 200 responses to unauthenticated requests that reference APEX application identifiers or internal object names.
Anomalous request patterns targeting /ords/ or /apex/ URI paths without accompanying authenticated session cookies.

Detection Strategies

Inventory all Oracle APEX instances and confirm which versions are exposed to untrusted networks. Focus on 24.1, 24.2, and 26.1.
Enable and review Oracle REST Data Services (ORDS) and web listener access logs for unauthenticated requests returning application data.
Correlate WAF logs with APEX application logs to identify enumeration or scraping patterns targeting APEX endpoints.

Monitoring Recommendations

Alert on spikes in unauthenticated HTTP traffic to APEX-hosting servers, particularly requests returning non-empty response bodies.
Track response size distributions for public APEX endpoints to detect exfiltration-style access patterns.
Forward APEX and ORDS logs to a centralized SIEM for retention and cross-source correlation.

How to Mitigate CVE-2026-60156

Immediate Actions Required

Apply the July 2026 Critical Patch Update from Oracle to all Oracle APEX instances running 24.1, 24.2, or 26.1.
Restrict network exposure of APEX administrative and application endpoints to trusted networks pending patching.
Review APEX access logs for signs of unauthenticated data access prior to remediation.

Patch Information

Oracle addressed CVE-2026-60156 in the July 2026 Critical Patch Update. Full remediation details are published in the Oracle Security Alert - July 2026. Administrators should follow Oracle's documented upgrade paths for each affected APEX version.

Workarounds

Place Oracle APEX behind a reverse proxy or web application firewall configured to block anonymous access to sensitive endpoints.
Disable public-facing APEX applications that are not required for business operations until the patch is applied.
Enforce network-layer access controls to limit HTTP reachability of APEX to authenticated user populations.

bash

# Example: restrict APEX/ORDS access at the reverse proxy layer (nginx)
location /ords/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://apex_backend;
}